> For the complete documentation index, see [llms.txt](https://docs.abbey.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.abbey.io/reference/access-policies/types-of-access-policies.md).

# Types of Access Policies

Abbey supports 3 types of policies: 

* [#allow-or-deny-access](#allow-or-deny-access "mention")
* [#expire-access](#expire-access "mention")
* [#skip-a-workflow-step](#skip-a-workflow-step "mention")

## Allow or Deny Access

Policies which allow or deny access to a user can be specified in the `policies` field of a Grant Kit. For example:

```hcl
resource "abbey_grant_kit" "abbey_example_kit" {
  name = "Abbey_Example"
  description = <<-EOT
    Grants access to Abbey's Demo Page.
  EOT

  workflow = {
    steps = [
      {
        reviewers = {
          one_of = ["bob@example.com"]
        }
      }
    ]
  }

  policies = [
    { bundle = "github://example-org/example-repo/policies" }
  ]

  output = ...
  }
}
```

Look at the `policies` field. The policy bundle specified must pass or Access Requests to this Grant Kit are denied. Policies used this way must use an `allow` variable such as below.&#x20;

```rego
allow[msg] {
  in_group("Marketing")
  msg := "allow marketing folks"
}
```

If attributes about a user change and make the policy invalid, then the policy access will be revoked. For example, if a user was granted access in the above policy and then gets moved out of the "Marketing" group, Abbey will revoke access.

## Expire Access

Abbey continues to check if policies for a given Access Request are valid. This can let you write access policies which expire access after a certain amount of time. Expiry based policies are also written in an `allow` Rego variable.

```rego
import data.abbey.functions

allow[msg] {
    functions.expire_after("60m")
    msg := "granting access for 60 minutes"
}
```

The above policy will allow access for 60 minutes, and then fail after 60 minutes. The failure will revoke access.

## Skip a Workflow Step

You can also use policies to skip Workflow steps. Look at the following example.

```hcl
resource "abbey_grant_kit" "abbey_example_kit" {
  name = "Abbey_Example"
  description = <<-EOT
    Grants access to Abbey's Demo Page.
  EOT

  workflow = {
    steps = [
      {
        reviewers = {
          one_of = ["bob@example.com"]
        }
        
        skip_if = [
          { bundle = "github://example-org/example-repo/policies/rbac" }
        ]
      }
    ]
  }

  policies = ...

  output = ...
  }
}
```

In the example, a review is required from `bob@example.com` to grant access through this Grant Kit. The review step may be skipped if the policy referred to in the `skip_if` section passes.

Policies given in a `skip_if` section must be placed in a `skip` variable such as below.

```rego
skip[msg] {
  in_group("Engineering")
  msg := "skipping review step for engineers"
}
```